Azure / Azure/azure-sdk-for-python

Incorrect token scope when using project.get_openai_client leads to 401

Open
#44,412 8 comments 0 reactions 1 assignee Claimed by @dargilco View on GitHub
AI Projects customer-reported needs-team-attention question Service Attention
Dominant language
Python
Stars
5.6k
Forks
3.4k
Avg merge
1d 21h
Merged PRs (30d)
193

Description

- **azure-ai-projects**:
- **2.0.0b2**:
- **Windows**:
- **python 3.12**:

**Describe the bug**

openai_client = project.get_openai_client()
response = openai_client.responses.create(
model="gpt-4.1",
input="What is the size of France in square miles?",
)

...fails with AuthenticationError: Error code: 401 - {'statusCode': 401, 'message': 'Unauthorized. Access token is missing, invalid, audience is incorrect (https://ai.azure.com/), or have expired.'}

(I have 'Azure AI Developer' role and 'Cognitive Services OpenAI User' set on the Foundry project.)

My impression is, get_openai_client() is supposed to switch contexts to the Data Plane Scope (https://cognitiveservices.azure.com), but it is failing to do so.

**To Reproduce**
Steps to reproduce the behavior:

Try the samples of the official Foundry (new) docs:
https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/develop/sdk-overview?view=foundry&pivots=programming-language-python#foundry-sdk

**Expected behavior**

It should reach and use the endpoint without error.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.